Worried About SQL Injection in Your API? Smoothie Bar

2026-11-01

The blender screams for eight seconds, and you miss half of the question.

You're standing at the counter of the juice bar below your coworking space, phone pressed to one ear, a finger in the other. It's Thursday, 10:35. The client's technical lead is on the line, friendly and unhurried.

"Quick one before we go live next week. Is the API safe from SQL injection?"

"Yes," you say. "Yes, should be fine."

The word should hangs there. He doesn't seem to notice. He says great, thanks, and moves on to the launch date. You nod at nobody and watch the woman behind the counter pour something green into a cup.

You paid for the smoothie with a phone that is still warm from the call. Your stomach feels like you ordered the wrong thing.

The answer you gave without knowing

Here is the part you wouldn't say out loud. You didn't know.

You wrote the endpoints yourself, over several weeks, in between other jobs. Most of the queries go through the library. You remember being careful. You also remember one search route you wrote in a hurry, and a filter parameter someone asked for on a Friday afternoon. Did that one build a string by hand? You can picture the file. You can't picture the line.

So you said yes the way people say "I'm fine" when someone asks in a corridor.

The worry is quiet, but it's busy. You carry the tray upstairs, sit down at your desk, and open the repository. Then you close it again, because where would you even start? Search for the word "query"? Read every route? Trust the feeling that you were careful?

On a freelance project there's no second pair of eyes. No security team down the hall. Just you, the code, and a client who now believes the question has been answered.

What it quietly costs

Nobody has been hurt. Nothing has gone wrong. That's what makes it hard to name.

But notice what the doubt does with your week. You half-listen in the next meeting. You check the logs on Saturday, though there's nothing to find. You think about the filter parameter in the shower. Launch day, which should feel like finishing, starts to feel like waiting for a verdict.

And there's the smaller cost, the one about how you see yourself. You're good at this work. You know you are. But a promise you can't back up makes you feel like someone who's winging it, and you aren't that person. You just have no way to see what you've built the way a stranger would see it.

Most of the fear lives in that gap between "I think it's fine" and "I checked."

The sentence that changed the afternoon

At 14:00 a friend from the coworking space drops into the chair beside you, holding her own cup. She builds shop backends for a living. You tell her about the call, a little sheepishly.

She doesn't laugh and she doesn't lecture. She says, "Do you have a list? Not in your head. An actual list you go down."

You don't. You have habits. You have instincts. You have a vague memory of reading something once.

"That's why it feels like a fog," she says. "You're trying to remember everything at once. Nobody can. You put it on paper, tick it off, and the fog turns into a to-do list."

It's a small thing to hear. But your shoulders drop an inch, because it means the problem was never you. It was the missing page. A careful person with no checklist feels exactly like a careless person, right up until someone hands them the page.

A different Thursday

Picture the same call, a week later.

The blender screams. The technical lead asks his question. You wait for the noise to stop, and this time you say, "I went through every route that touches the database. Here's what I checked and here's the short report. One thing needed a fix. It's fixed."

There's a small pause on the line, the kind that means respect.

You hang up and your smoothie is still cold. Nothing in your chest is tight. You don't open the repo to reassure yourself, because the reassurance is already written down, in a tracker, in your own handwriting, with ticks.

The weekend belongs to you again. The launch is a date on a calendar instead of a verdict you're waiting for. And the next time a client asks a security question, you don't flinch. You have somewhere to point.

That's the whole change. You don't need to become a security expert. You need a calm, repeatable way to look at what you built, so "should be fine" can become "I checked."

If you recognised yourself

If this Thursday felt familiar, we made something for exactly this moment. Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item review kit: a PDF checklist, an XLSX tracker, curl tests, an auth-route scanner script and a client report template, for Node/Express and Python. It's a way to look at your own API with fresh eyes and hand your client something real. It organises your review. It doesn't replace a professional security audit, and the decisions stay yours.

There's a 30-day money-back promise: if it doesn't help, you get a full refund, no questions asked.

Take a look at the API Security Review Checklist Kit

An illustrative story, written with AI assistance.